Missing Authorization in Froxlor - #VU162726
Published: November 9, 2026
Vulnerability identifier: #VU162726
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated customer to delete a reseller-assigned main domain belonging to their own account in Froxlor.
The vulnerability exists due to missing authorization in the SubDomains.delete API command, which does not check parentdomainid to distinguish main domains from deletable subdomains. An authenticated customer can submit the assigned main domain's identifier using their own API credentials and remove the domain despite the interface prohibiting deletion.
Affected software
Froxlor
Remediation
Install security update from vendor's website.
Froxlor - update to 2.3.15